CVE-2023-0669: Fortra GoAnywhere MFT RCE Vulnerability

CVE-2023-0669 Overview

CVE-2023-0669 is a critical pre-authentication command injection vulnerability affecting Fortra (formerly HelpSystems) GoAnywhere MFT, a widely-deployed managed file transfer solution used by enterprises to securely exchange sensitive data. The vulnerability exists in the License Response Servlet and stems from insecure deserialization of attacker-controlled objects, allowing unauthenticated remote attackers to execute arbitrary commands on vulnerable systems.

This vulnerability was actively exploited in the wild as a zero-day before patches were available, leading to its inclusion in the CISA Known Exploited Vulnerabilities Catalog. The Cl0p ransomware gang notably leveraged this vulnerability to compromise over 130 organizations, making this one of the most impactful vulnerabilities of 2023.

Critical Impact

This pre-authentication vulnerability allows unauthenticated attackers to achieve remote code execution on GoAnywhere MFT servers, potentially leading to complete system compromise, data exfiltration, and ransomware deployment.

Affected Products

• Fortra GoAnywhere Managed File Transfer versions prior to 7.1.2
• GoAnywhere MFT deployments with administrative console exposed to the network
• Organizations running unpatched GoAnywhere MFT instances

Discovery Timeline

• 2023-02-06 - CVE-2023-0669 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2023-0669

Vulnerability Analysis

The vulnerability resides in GoAnywhere MFT's License Response Servlet, which improperly handles incoming serialized Java objects. When processing license-related requests, the servlet deserializes user-supplied data without adequate validation, creating a classic insecure deserialization condition (CWE-502). An attacker can craft a malicious serialized object that, when deserialized by the vulnerable servlet, triggers arbitrary command execution on the underlying system.

The attack requires network access to the GoAnywhere MFT administrative console, typically accessible on port 8000 or 8001. Since the vulnerability exists in a pre-authentication code path, attackers do not need valid credentials to exploit it. The Rapid7 analysis confirms the exploitation requires network access but no user interaction or authentication.

Root Cause

The root cause is the unsafe deserialization of Java objects in the License Response Servlet. The servlet accepts serialized data from network requests and deserializes it without implementing proper input validation or using a secure deserialization library. This allows attackers to inject malicious serialized objects containing gadget chains that execute arbitrary commands upon deserialization.

The vulnerable code fails to:

• Validate the type of objects being deserialized
• Implement object filtering during deserialization
• Restrict the classes that can be instantiated during deserialization

Attack Vector

The attack exploits the network-accessible License Response Servlet endpoint. An attacker sends a specially crafted HTTP request containing a malicious serialized Java object to the GoAnywhere MFT administrative interface. The exploitation process involves:

1. Identifying a GoAnywhere MFT instance with an exposed administrative interface
2. Constructing a serialized Java object payload using known gadget chains
3. Sending the malicious payload to the License Response Servlet endpoint
4. The servlet deserializes the object, triggering code execution with the privileges of the GoAnywhere MFT service

The vulnerability has been weaponized in publicly available exploit code. A Metasploit module was developed for this vulnerability, and additional exploit details are available in the Packet Storm security advisory. For detailed technical analysis, refer to the Frycos vulnerability research blog.

Detection Methods for CVE-2023-0669

Indicators of Compromise

• Unusual HTTP requests to the GoAnywhere MFT administrative interface, particularly targeting /goanywhere/lic/accept or similar license-related endpoints
• Unexpected child processes spawned by the GoAnywhere MFT Java process
• Suspicious outbound network connections from GoAnywhere MFT servers to unknown external hosts
• Presence of webshells or backdoors in the GoAnywhere MFT installation directories
• Unexpected file system modifications or new files created by the GoAnywhere service account

Detection Strategies

• Monitor network traffic for anomalous requests to GoAnywhere MFT administrative ports (8000/8001) containing serialized Java objects
• Implement behavioral analysis to detect post-exploitation activities such as command execution, lateral movement, or data exfiltration originating from GoAnywhere MFT servers
• Deploy endpoint detection solutions capable of identifying deserialization attack patterns and suspicious process lineage
• Review GoAnywhere MFT logs for authentication failures, unusual API calls, or license-related servlet access from unexpected IP addresses

Monitoring Recommendations

• Enable verbose logging on GoAnywhere MFT servers and forward logs to a centralized SIEM for analysis
• Configure alerts for any access to the administrative console from non-approved IP addresses or network segments
• Monitor file integrity on GoAnywhere MFT installation directories to detect unauthorized modifications
• Implement network segmentation monitoring to detect lateral movement attempts from compromised MFT servers

How to Mitigate CVE-2023-0669

Immediate Actions Required

• Upgrade GoAnywhere MFT to version 7.1.2 or later immediately
• If patching is not immediately possible, restrict network access to the administrative console (ports 8000/8001) to trusted management networks only
• Review system logs and file integrity for signs of compromise before and after patching
• Implement network segmentation to isolate GoAnywhere MFT servers from sensitive network segments

Patch Information

Fortra has released version 7.1.2 of GoAnywhere MFT which addresses this vulnerability. Organizations should prioritize upgrading to this version or later. The patch information and security advisories are available through the GoAnywhere Security Advisories portal. Additional context on the zero-day exploitation and patch availability can be found in the Rapid7 blog post and Duo Security advisory.

Workarounds

• Disable the License Response Servlet if not required for operations (consult Fortra documentation for proper procedures)
• Implement network-level access controls to block external access to the administrative interface
• Deploy a web application firewall (WAF) with rules to detect and block serialized Java object payloads
• Consider temporary shutdown of GoAnywhere MFT services if immediate patching is not possible and the system is exposed to untrusted networks

# Example firewall rule to restrict administrative interface access (iptables)
# Restrict GoAnywhere MFT admin ports to management network only
iptables -A INPUT -p tcp --dport 8000 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -j DROP